Kestrel HTTPS 显示证书链

Question

我正在使用没有中间 CA 的自定义（受信任）证书链构建 Web 服务，当我使用 Kestrel 终止 SSL 时，它仅显示我的服务器证书：

如果我访问网络上的任何网站，我都会看到整个证书链：

如何让 Kestrel 呈现整个证书链？ 如果我访问 google.com

Answer 1

如果您使用的是 .NET 8，这是配置 Kestrel 为整个证书链提供服务的代码。

// Program.cs

using System.Security.Cryptography.X509Certificates;

var builder = WebApplication.CreateBuilder(args);
builder.WebHost.ConfigureKestrel((_, serverOptions) =>
{
    var certificate = X509Certificate2.CreateFromPemFile("certs/server-certificate.crt", "certs/server-certificate.key");
    serverOptions.ListenLocalhost(7000, listenOptions => listenOptions.UseHttps(certificate, httpsConnectionAdapterOptions =>
    {
        var x509Certificate2Collection = new X509Certificate2Collection();
        x509Certificate2Collection.ImportFromPemFile("certs/ca-chain-bundle.crt");
        httpsConnectionAdapterOptions.ServerCertificateChain = x509Certificate2Collection;
    }));
});
var app = builder.Build();
app.MapGet("/", () => "Hello World!");
app.Run();